Detection rules › Elastic
Privileged Accounts Brute Force
Identifies multiple consecutive logon failures targeting more than one Admin account from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1110 Brute Force, T1110.001 Brute Force: Password Guessing, T1110.003 Brute Force: Password Spraying |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 4625 | An account failed to log on. |
Stages and Predicates
Stage 1: esql:from
Stage 2: esql:where
not winlog.event_data.Status:(0xc000005e or 0xc00000dc or 0xc0000133 or 0xc000015b or 0xc0000192) and not <macro:> and event.action:"logon-failed" and event.category:"authentication" and source.ip:* and winlog.computer_name:* and winlog.logon.type:"Network"Stage 3: esql:eval
Stage 4: esql:stats
Stage 5: esql:where
Esql.count_distinct_user_name >= 2 and Esql.failed_auth_count >= 50Stage 6: esql:eval
Stage 7: esql:keep
Exclusions
Top-level NOT(...) conjuncts — predicates this rule actively suppresses.
| Stage | Field | Kind | Excluded values |
|---|---|---|---|
| 1 | Status | in | 0xc000005e, 0xc00000dc, 0xc0000133, 0xc000015b, 0xc0000192 |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Esql.count_distinct_user_name | ge |
|
Esql.failed_auth_count | ge |
|
event.action | eq |
|
event.category | eq |
|
winlog.logon.type | eq |
|
Neighbors
Stricter alternatives (narrower than this rule)
The rules below may be useful if you find the current rule is too noisy / lacks specificity.
- Windows Multiple Users Failed To Authenticate From Process (adds 3 filters)
- Windows Multiple Users Remotely Failed To Authenticate From Host (adds 3 filters)
- Windows Unusual Count Of Users Failed To Authenticate From Process (adds 3 filters)
- Windows Unusual Count Of Users Remotely Failed To Auth From Host (adds 3 filters)